Exploit for Improper Input Validation in Ui Unifi_Os_Server

UniFi OS CVE Proof of Concept Proof of concept untuk pengujia...

Exploit for Authentication Bypass by Capture-replay in Microsoft

CVE-2026-62911 Pre-auth RCE on Microsoft Exchange Server. No...

UBUNTU-CVE-2026-53525

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

mod-auth-openidc:fuzz_url: Global-buffer-overflow in oidc_cfg_redirect_urls_allowed_get

Detailed Report: https://oss-fuzz.com/testcase?key=5158051179724800 Project: mod-auth-openidc Fuzzing Engine: afl Fuzz Target: fuzzurl Job Type: aflasanmod-auth-openidc Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x571dec30dcf8 Crash State:...

CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

CVE-2026-53497

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

CVE-2026-53497

CrossWatch (a synchronization engine) prior to version 0.9.21 exposes an unauthenticated information disclosure via the GET /api/app-auth/status endpoint. The endpoint returns the other_sessions array without requiring credentials, leaking metadata for all active sessions including originating IP...

CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

JLSEC-2026-1372

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

Exploit for Improper Authentication in Apple Macos

CVE-2026-65400 — macOS Screen Sharing pre-auth root file read...

CVE-2026-66786

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...

CVE-2026-55241 Checkmate: Pre-auth Denial of Service via File Upload on Registration

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...

CVE-2026-55241

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...

Exploit for CVE-2026-58455

CVE-2026-58455 — Dockwatch Unauthenticated RCE auth bypass +...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

BIT-MLFLOW-2026-69146 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFOREREQUESTHANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs...

CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

CVE-2026-59799

Apache CloudStack is affected by an improper privilege management vulnerability in its Two-factor authentication plugin . The flaw allows for a bypass of the two-factor authentication disable flow due to a missing privilege check. This issue impacts versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0...

CVE-2026-53497: Exposure of Sensitive Information to an Unauthorized Actor

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...